v0.27.1
This commit is contained in:
Mateusz Gruszczyński committed
1 parent
3a2eb4fe79
commit
e0194fbaff
63 files changed
+1553
-379
No files matched your search
+27
-17
@@ -1,4 +1,4 @@
|
||||
# Installing and updating RustProxy 0.27.0
|
||||
# Installing and updating RustProxy 0.27.1
|
||||
|
||||
The scripts prepare a Linux/systemd installation. This source archive is **not a
|
||||
verified production build**: Rust/Cargo, real CA operations, live systemd startup
|
||||
@@ -31,7 +31,7 @@ Plain remote HTTP requires both an explicit non-loopback `RUSTPROXY_ADMIN_LISTEN
|
||||
Equivalent prerequisite commands are:
|
||||
|
||||
```bash
|
||||
apt install -y build-essential gcc git ca-certificates python3 pkg-config wget sudo python3-certbot-dns-rfc2136 python3-certbot-dns-cloudflare
|
||||
apt install -y build-essential gcc git ca-certificates python3 python3-venv python3-pip pkg-config wget sudo certbot python3-certbot-dns-rfc2136 python3-certbot-dns-cloudflare python3-certbot-dns-ovh
|
||||
wget -qO- --https-only --secure-protocol=TLSv1_2 https://sh.rustup.rs | sh
|
||||
```
|
||||
|
||||
@@ -154,25 +154,35 @@ editable desired-state entries.
|
||||
|
||||
## ACME prerequisites
|
||||
|
||||
Automatic renewal runs inside RustProxy, not a separately installed cron timer.
|
||||
Install `certbot`, the DNS plugins you use (`certbot-dns-cloudflare`,
|
||||
`certbot-dns-ovh`, `certbot-dns-rfc2136`), Python and OpenSSL on the server. HTTP-01
|
||||
uses Certbot's webroot authenticator, not a competing standalone web server.
|
||||
Certbot and its plugins must be in the **same Python environment**. An optional
|
||||
root-owned virtual environment at `/opt/rustproxy-certbot` is on the service PATH;
|
||||
otherwise use `/usr/local/bin` or `/usr/bin`. Avoid an executable under an
|
||||
administrator's home directory: the unit uses `ProtectHome=true`.
|
||||
Automatic renewal runs inside RustProxy, not a separately installed cron timer. RustProxy
|
||||
prefers a private Python environment at `<data-dir>/acme-python`. When that environment is
|
||||
missing or incomplete, the service creates it automatically and installs the pinned Certbot
|
||||
core plus the Cloudflare, OVH and RFC2136 plugins with `pip`. The application never executes
|
||||
`sudo` and never modifies distribution-owned Python site-packages.
|
||||
|
||||
Check the effective service account's environment rather than only your shell:
|
||||
The host should provide Python 3 with either the standard `venv` module or `pip`; RustProxy can
|
||||
bootstrap `virtualenv` into its own data directory when a distribution splits `venv` into a
|
||||
separate package. OpenSSL remains a local certificate-inspection fallback. If the private
|
||||
environment cannot be created, RustProxy uses a runnable distribution `certbot` from `PATH`
|
||||
when one is available.
|
||||
|
||||
If Python is absent (a possible layout on appliances such as OPNsense), or Python is present
|
||||
but no local environment can be created and no system Certbot exists, the Certificates panel
|
||||
shows ACME as unavailable. PEM upload and references to existing certificate files remain
|
||||
available.
|
||||
|
||||
On the standard service installation the managed environment therefore lives at
|
||||
`/var/lib/rustproxy/acme-python`. Do not run a second Certbot renewal timer over RustProxy's
|
||||
`certs/acme` profiles. See [renewal](RENEWAL.md).
|
||||
|
||||
A source-tree preflight can still inspect a distribution-provided fallback environment with:
|
||||
|
||||
```bash
|
||||
sudo -u rustproxy env PATH=/opt/rustproxy-certbot/bin:/usr/local/bin:/usr/bin:/bin \
|
||||
sudo -u rustproxy env PATH=/usr/local/bin:/usr/bin:/bin \
|
||||
python3 scripts/acme_provider.py --doctor
|
||||
```
|
||||
|
||||
The provider scripts are embedded in the binary; the source file above is just a
|
||||
preflight command. The service owns its complete private `certs/acme` tree. Do not
|
||||
run a second Certbot renewal timer over those same profiles. See [renewal](RENEWAL.md).
|
||||
The provider script is embedded in the RustProxy binary; this command is diagnostic only.
|
||||
|
||||
### Using a separate system Certbot
|
||||
|
||||
@@ -182,14 +192,14 @@ A Certbot deploy hook can publish every successful renewal to all vhosts that al
|
||||
that id:
|
||||
|
||||
```bash
|
||||
/usr/bin/rust-proxy tls deploy --id shared-cert \
|
||||
/opt/rustproxy/current/rust-proxy --data-dir /var/lib/rustproxy tls deploy --id shared-cert \
|
||||
--cert /etc/letsencrypt/live/example/fullchain.pem \
|
||||
--key /etc/letsencrypt/live/example/privkey.pem
|
||||
```
|
||||
|
||||
The command reads the Certbot files locally and sends them to the authenticated loopback `POST /api/certificates/deploy` endpoint. The running RustProxy service writes the private generation with its own filesystem identity and hot-publishes it for new public TLS/H2/H3 handshakes. No per-vhost edit is needed. If another
|
||||
local process instead replaces the exact files already referenced by RustProxy, run
|
||||
`/usr/bin/rust-proxy tls reload` (or authenticated `POST /api/certificates/reload`) afterward. If the replacement belongs to one configured manual certificate ID, automation may instead call `POST /api/certificates/{certificate_id}/reload`; the same endpoint accepts a scoped Certificate API Key ID + Bearer token and does not change the configuration revision.
|
||||
`/opt/rustproxy/current/rust-proxy --data-dir /var/lib/rustproxy tls reload` (or authenticated `POST /api/certificates/reload`) afterward. If the replacement belongs to one configured manual certificate ID, automation may instead call `POST /api/certificates/{certificate_id}/reload`; the same endpoint accepts a scoped Certificate API Key ID + Bearer token and does not change the configuration revision.
|
||||
Administration TLS is startup-fixed and may still require a service restart.
|
||||
|
||||
Optional environment overrides go in a root-owned `/etc/rustproxy/environment`
|
||||
|
||||
Reference in new issue
Block a user